Computer Networks Lab Lab 3 Managing User and Computer Accounts. Prepared By: Eng.Ola M. Abd El-Latif

Transcription

1 Islamic University of Gaza College of Engineering Computer Department Computer Networks Lab Lab 3 Prepared By: Eng.Ola M. Abd El-Latif Mar. / :D

2 Objectives Define user and computer account. Describe & modify the properties associated with user and computer accounts. Enable and disable user accounts. Explain how user accounts can become locked-out. When to Reset User Passwords & When to Reset Computer Accounts Introduction User Account A user account is an object that consists of all the information that defines a user in Windows Server The account can be either a local or domain account. A user account includes the user name and password with which the user logs on, the groups that the user account is a member of, and the user rights and permissions the user has for gaining access to computer and network resources. Types of User Account Names Associated with Domain User Accounts 1. User logon name. 2. Pre-windows 2000 logon name. 3. Use principle logon name. 4. LDAP(Lightweight Directory Access Protocol) distinguished name. Administrators use this name to add users to the network from a script or command line. 5. LDAP relative distinguished name. Uniquely identifies the object within its parent container. 1

3 User Account Placement in a Hierarchy You can place domain user accounts in any domain in the forest and any organizational unit in the domain. Typically, account hierarchies are based on geopolitical boundaries or business models. 2

4 User account password option As a system administrator, you can manage user account password option. The following option can be set when the user account is created or from the properties dialog box of user account: When to Require or Restrict Password Changes.. 3

5 How to Create User Accounts Domain user accounts enable users to log on to a domain and access resources anywhere on the network, and local user accounts enable users to log on and access resources only on the computer on which you create the local user account. As a systems administrator, you must create domain and local user accounts to manage your network environment. There are two ways to create a domain user account: 1) Using Graphical user interface. 2) Using Dsadd command. Creating User Account using Graphical user interface 1. Click Start, point to Administrative Tools, and then click Active Directory Users and Computers. 2. In the console tree, double-click the domain node. 3. In the details pane, right-click the organizational unit where you want to add the user, point to New, and then click User. 4. In the New Object - User dialog box, in the First name box, type the user's first name. 5. In the Initials box, type the user's initials. 6. In the Last name box, type the user's last name. 7. In the User logon name box, type the name that the user will log on with. 8. From the drop-down list, click the UPN suffix that must be appended to the user logon name after the at sign (@). 9. Click Next. 10. In the Password and Confirm password boxes, type the user's password. 11. Select the appropriate password options. 12. Click Next, and then click Finish. Default password settings By default, passwords in a Windows 2003 Active Directory domain must meet several minimum requirements. Must not contain all or part of the user s account name. Must be at least seven characters in length. Must contain characters from three of the following four categories: English uppercase characters (A through Z) English lowercase characters (a through z) Base 10 digits (0 through 9) Nonalphabetic characters (for example,!, $, #, %) 4

6 Creating User Account using a command line Another way to create a domain user account is to use the dsadd command. The dsadd user command adds a single user to the directory from a command prompt or batch file. Ex: dsadd user "cn=eman ali,ou=it admin,dc= NetworkLab,dc=com" Note/ Use " " if there is a space in any variable. For the complete syntax of the dsadd user command, at a command prompt, type dsadd user /?. Properties Associated with User Accounts 5

7 Enable and Disable User Accounts To provide a secure network environment, a systems administrator must disable user accounts when users do not need their accounts for an extended period, but need to use them later. The following are examples of when you need to enable or disable user accounts: If the user takes a two-month leave of absence from work, you disable the account when the user leaves and then enable the account when the user returns. When you add accounts in the network that will be used in the future or for security purposes, you disable the accounts until they are needed. Disable an account when you do not want users to be authenticated from a shared computer. 6

8 Locked-out User Accounts Introduction A user account is locked out because the account has exceeded the account lockout threshold for a domain. This may be because the user has attempted to access the account with an incorrect password too many times or because a computer hacker has attempted to guess users. Passwords and invoked the Lockout policy on the account. 7

9 Account lockout threshold Authorized users can lock themselves out of an account by mistyping or forgetting their password or by changing their password on a computer while they are logged on to another computer. The computer with the incorrect password continuously tries to authenticate the user. Because the password it is using to authenticate is incorrect, the user account is eventually locked out. A security setting in Active Directory determines the number of failed logon attempts that causes a user to be locked out. A user cannot use a locked-out account until an administrator resets the account or until the lockout duration for the account expires. When a user account is locked out, an error message appears, and the user is not allowed any further logon attempts. Resetting User Passwords People occasionally forget their passwords. Without their passwords, these people cannot access their user accounts. Administrators can reset user s Passwords so that users can access their accounts again. Before attempting to reset local or domain passwords, verify that you have the appropriate level of authority. How to Reset User Passwords Renaming a User Account Occasionally, employees in your organization will need to change their user name for personal or legal reasons. For example, employees who get married and legally change their surnames will need their user account names updated. Instead of deleting the old account and creating a new user, you can rename the original account. Use the following procedure to rename a user account. 8

10 9

11 Computer account Introduction: Every computer running Microsoft Windows NT, Windows 2000, Windows XP, or Windows Server 2003 that joins a domain has a computer account. Similar to user accounts, computer accounts provide a means for authenticating and auditing computer access to the network and to domain resources. What does a computer account do? In Active Directory, computers are security principles, just like users. This means that computers must have accounts and passwords. To be fully authenticated by Active Directory, a user must have a valid user account, and the user must also log on to the domain from a computer that has a valid computer account. How to create a computer account Creating Computer Account using Graphical user interface 1. In Active Directory User and Computers, in the console tree, right-click Computers or the container in which you want to add the computer, point to New, and then click Computer. 2. In the New Object- Computer dialog box, in the Computer name box, type the computer name. 3. Select the appropriate options, and then click Next. 4. In the Managed dialog box, click Next. 5. Click Finish. Creating Computer Account using a command line Ex: dsadd computer "cn=pc1,ou=lab1,dc=networklab,dc=com" 10

12 Properties Associated with Computer Accounts 11

13 When to Reset Computer Accounts?? Reset computer accounts when: Computers fail to authenticate to the domain Passwords need to be synchronized As a systems administrator, you occasionally need to reset computer accounts. For example, suppose that your network went through a full backup seven days ago. The computer relayed information to the domain controller that changed the password on the computer account. However, the computer s hard drive crashed, and the computer was restored from tape backup. The computer now has an outdated password, and the user cannot log on because the computer cannot authenticate to the domain. You now need to reset the computer account. Tools used to modify user or computer accounts You can use Active Directory Users and Computers or the dsmod command to modify attributes of existing users or computers in Active Directory. Note/ For the complete syntax of the dsmod command, at a command prompt, type dsmod user /? or dsmod computer /?. 12